33

Are they encrypted in disk? How? Are they safe, for example, in the event of someone booting from a Live CD and mounting the hard disk?

How is the encryption key generated? Is it different in Windows and Linux?

Improve this question
2

5 Answers 5

Reset to default
34

You seem to be curious specifically about the key used to encrypt the passwords in Chrome.

The answer is:

Every password is encrypted with a different random key.

And then the encrypted password is stored in the SQLite database file:

%LocalAppData%\Google\Chrome\User Data\Default\Login Data

You can use something like SQLite Database Browser or SQLite Maestro to view it. Here's a snippet from my Login Data file:

origin_url                                username_value               password_value
========================================  ==============               ========================
http://thepiratebay.org/register          [email protected]  01000000D08C9DDF0115D1118C7A00C04FC297EB01000000BB0E1F4548ADC84A82EC0873552BCB460000000002000000000003660000C0000000100000006811169334524F33D880DE0C842B9BBB0000000004800000A00000001000000043C8E23979F5CC5499D73610B969A92A08000000EE07953DEC9F7CA01400000098B5F0F01E35B0DC6BBAFC53A9B1254AC999F4FA

You'll notice the password is an encrypted blob of data. The approximate algorithm to encrypt a new password is:

  • generate a new random session key
  • encrypt the password with the session key
  • encrypt the session key with the user's RSA public key
  • generate a Message Authentication Code (HMAC) for the encrypted data
  • concatenate the encrypted session key, the encrypted password, and the MAC

And Chrome saves that blob to its SQLite database.

But to answer your question: Where does the encryption key come from?

Each password is encrypted with a different randomly generated key

The Technical Details

Of course i left out the technical details. Chrome does not encrypt your passwords itself. Chrome does not have a master key used to encrypt anything. Chrome does not do the encryption. Windows does.

There is a Windows function, CryptProtectData, which is used to encrypt any arbitrary data you like. The details of calling it is less important. But if i invent a pseudo-language that somewhat can be decipherable as any programming languge, Chrome calls:

CryptProtectData(
      { cbData: 28, pbData: "correct battery horse staple" },
      "The password for superuser.com and all the glee therein",
      null, //optional entropy
      null, //reserved
      null, //prompt options
      0, //flags
      { cbData:   pbData:  }); //where the encrypted data will go

So the password:

  • Plaintext: correct battery horse staple
  • Encrypted: 01000000D08C9DDF0115D1118C7A00C04FC297EB01000000BB0E1F4548ADC84A82EC0873552BCB460000000002000000000003660000C0000000100000006811169334524F33D880DE0C842B9BBB0000000004800000A00000001000000043C8E23979F5CC5499D73610B969A92A08000000EE07953DEC9F7CA01400000098B5F0F01E35B0DC6BBAFC53A9B1254AC999F4FA

You'll notice that i never needed to supply a password. That is because Windows takes care of all of that. In the end:

  • a random password is generated to encrypt the password
  • that password is encrypted with a random password
  • that password is encrypted with your Windows password

So the only way for someone to know your password is if they know your password.

Note: It goes without saying, but I'll say it anyway: this only applies to Chrome running on Windows.

Improve this answer
13
  • 2
    @brunoais Chrome does not know the key used to encrypt passwords. Chrome does not decrypt them - Windows does.
    – Ian Boyd
    Oct 19, 2013 at 16:28
  • 1
    Ah, ok. So if a malicious program gets into the computer the passwords are completely available to that program, right?
    – brunoais
    Oct 19, 2013 at 18:26
  • 2
    @brunoais Only if you've typed in your password. Unfortunately this is a fundamental limitation of encryption: once data is decrypted it is decrypted.
    – Ian Boyd
    Oct 19, 2013 at 19:26
  • 1
    Thanks. Chrome stopped my remembering my passwords (it still offered to save them, but never recalled them), I figured the password database was corrupted. Solved by deleting %LocalAppData%\Google\Chrome\User Data\Default\Login Data
    – Colonel Panic
    Oct 21, 2015 at 14:01
  • 1
    wait! so theoretically: if chrome uses the win API func 'CryptProtectData' then I just have to find the polar opposite function 'DecryptUnprotectData' to undo it, that I can probably find in a .NET lookup table somewhere? or just google?
    – pythonian29033
    Jul 15, 2016 at 13:18
10

The passwords are encrypted and stored in a SQLite database:

The important piece here is CryptProtectData, which is a Windows API function for encrypting data. Data encrypted with this function is pretty solid. It can only be decrypted on the same machine and by the same user that encrypted it in the first place.

Improve this answer
8
  • But how is the encryption key generated? Depending on this I would consider the scheme more or less secure. And what about Linux?
    – Óscar
    May 29, 2010 at 18:39
  • @Óscar: On Windows, CryptProtectData uses your Windows credentials (not the password, but some other data) as the key. AFAIK, it's the same function used to protect your certificates, network credentials and all that stuff.
    – u1686_grawity
    May 29, 2010 at 19:23
  • 3
    @Óscar: On Linux, Encryptor::EncryptString does not do anything. There seems to be code for using GNOME Keyring and KDE Wallet.
    – u1686_grawity
    May 29, 2010 at 19:38
  • 1
    Correct. On Linux, KDE Wallet, GNOME Keyring, or one other supported native password store (which I forget offhand) is used instead.
    – Michael Hampton
    Oct 7, 2012 at 23:47
  • 1
    so...it seems it is possible to have another separate app that basically snoops your chrome passwords, given that you're already logged in and it's running as you?
    – rogerdpack
    Nov 26, 2012 at 20:35
3

They are "encrypted" but it's a reversable encryption. Chrome has to send the raw password to the site it was stored for, so if Chrome can decrypt and use it, so can other people. Storing passwords is never 100% safe.

Improve this answer
9
  • But which is the encryption key?
    – Óscar
    May 29, 2010 at 18:38
  • 2
    Check the answer of sblair. Note that there is a possibility of decryption, no matter how it is stored. With the proper software, anyone could decrypt it. When you have logged into your Windows account until the moment you log out, your passwords are completely usable and completely viewable. Just indicating that there is not a 100% safe solution of storing browser passwords.
    – Pylsa
    May 29, 2010 at 18:39
  • 1
    No but if your computer is hijacked/infected, browser passwords could easily be recovered without you noticing. Once again, all I'm pointing out is that there's no 100% failproof password storage for browsers... Just answering your question about their safety.
    – Pylsa
    May 29, 2010 at 18:48
  • 1
    There is no "master password". CryptProtectData is a Windows API, Windows actually does all the encryption and retrieval, the encryption key is dependent on your user account and system.
    – Pylsa
    May 29, 2010 at 18:52
  • 1
    This should provide you with an explanation of its workings: msdn.microsoft.com/en-us/library/ms995355.aspx
    – Pylsa
    May 29, 2010 at 19:02
3

Google Chrome encrypts passwords and stores them in SQLite DB but they could be easily viewed with the special password recovery applications such as ChromePass (http://www.nirsoft.net/utils/chromepass.html) or SecurePassword Kit (http://www.getsecurepassword.com/)

Improve this answer
3

On the Mac, the equivalent to the CryptProtectData function in Windows is to access the password for "Chrome Safe Storage" in OS X's Keychain.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .